Bulk Email Domain Audit: SPF, DKIM, DMARC, MX, BIMI, MTA-STS

Paste a list of domains (or email addresses) and get a deliverability authentication report card for each: score, A–F grade, and a plain-English fix list. It checks what Gmail, Yahoo and Microsoft require from senders:

• SPF: missing or duplicate records, +all/?all, and the 10-DNS-lookup limit counted through every nested include, the most common hidden cause of SPF permerror.
• DMARC: present, policy (none/quarantine/reject), pct, reporting (rua), alignment.
• DKIM: probes 60+ common selectors (Google, Microsoft 365, SendGrid, Mailchimp, Klaviyo, HubSpot, Amazon SES, Zoho, Hostinger, Resend…), reports key size, and flags 1024-bit keys and revoked or wildcard keys.
• MX / mail provider (Google Workspace, Microsoft 365, Proofpoint, Mimecast, Zoho, and more) plus sending platforms inferred from SPF.
• BIMI, MTA-STS, TLS-RPT, and a single bulkSenderReady flag.
• Monitor mode: schedule it and get alerted when any domain's SPF, DMARC, DKIM, MX or grade changes.

Who it's for

• Cold-email and outbound teams: audit every sending domain and inbox-rotation domain before warming it.
• Agencies and MSPs: one report across all client domains, re-run weekly to catch breakage.
• Lead-gen / sales intel: segment prospects by mail provider (Google vs Microsoft vs gateway like Proofpoint) and email maturity.
• Security teams: watch for DMARC downgrades or SPF changes on your own brands.

Input

{"domains":["acme.com","jane@globex.com"],"extraDkimSelectors":["mycustom2024"],"monitorMode":false}

Output (trimmed)

{"domain":"therealtour360.com","grade":"B","score":87,"mailProvider":"Hostinger","bulkSenderReady":true,
 "spf":{"record":"v=spf1 include:_spf.mail.hostinger.com ~all","all":"softfail","lookups":3},
 "dmarc":{"policy":"none","rua":null},"dkim":{"found":[{"selector":"hostingermail-a","approxKeyBits":2048}]},
 "issues":[{"severity":"medium","code":"DMARC_P_NONE","message":"DMARC is monitor-only (p=none)..."},
           {"severity":"low","code":"DMARC_NO_RUA","message":"No rua= reporting address..."}]}

How it works and limits

• Public DNS only (DNS-over-HTTPS via Cloudflare with Google as fallback). It never connects to mail servers, sends email, or checks mailboxes, so it's safe to run on any domain.
• DKIM: DNS can't list selectors, so a domain that signs with a custom selector shows DKIM_NOT_FOUND. Add the selector from a real email header (DKIM-Signature: s=...) via extraDkimSelectors. Big senders (e.g. google.com) rotate dated selectors and will show this.
• Key size is estimated from the public key length (±, good enough to spot 1024-bit keys).
• No blocklist (DNSBL) checks: the major lists forbid commercial use through public resolvers.

Related tools

• Bulk Email Validator: Syntax, MX, Disposable & Role Check
• Bulk DNS Lookup & DNS Change Monitor
• Website Contact Details Extractor: Emails, Phones & Socials
• Bulk HTTP Security Headers Checker & Grade (with change alerts)
• Bulk Domain WHOIS (RDAP) Lookup: Age, Expiry, Registrar & DNS